feat(client/abr): learn the host's rate cap from short acks, and read host encode time as a signal

Two client-side halves of the §ABR-overdrive fix (the 4K120 sessions that
climbed to 1 Gbps against a 794 Mbps encoder and a 8.33 ms budget):

- Short-ack cap learning: the host now resolves a climb it can't serve to what
  the encoder actually runs at (its codec-level ceiling, or the current rate
  while encode is behind cadence). Two consecutive identical short acks latch
  that value as a host cap the climb logic folds into its ceiling — one short
  ack stays a transient (a failed rebuild also acks short once). The cap is
  mode-scoped (cleared on an accepted mode switch, tracked via a mode
  generation counter the control task bumps) and re-probes one step after ~60 s
  parked clean, so a heavy-scene refusal can't quietly cap the whole session.

- Host-encode-latency down-driver: the per-AU 0xCF `encode_us` the host
  already ships (and the overlay already draws) now feeds the controller
  through its own window accumulator — the overlay channel is lossy and
  embedder-drained, so the ABR gets a dedicated mirror of the decode-latency
  path. Baseline-relative like the decode signal (an escalated host reports
  encode_us inflated by ~a frame of queue depth; an absolute budget threshold
  would read permanently red), with the baseline rebased after our own
  decreases so one backoff doesn't train-fire into the floor. This is the only
  signal that can push an already-too-high rate back under the encoder's
  compute knee — host climb refusal stops the climb, but nothing else descends
  on a clean LAN.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

crates/punktfunk-core/src/client/pump.rs

@@ -112,6 +112,12 @@ pub(super) async fn run_pump(args: WorkerArgs) {
     // Adaptive bitrate ack slot: the control task parks the latest BitrateChanged here; the
     // pump's controller drains it on its report tick (`take()` — an ack is consumed once).
     let bitrate_ack: Arc<Mutex<Option<u32>>> = Arc::new(Mutex::new(None));
+    // Host-encode-latency accumulator (the ABR encode signal, see [`EncodeLatAcc`]): the
+    // datagram task adds one sample per 0xCF; the pump drains a window mean per report tick.
+    let encode_lat = Arc::new(Mutex::new(super::frame_channel::EncodeLatAcc::default()));
+    // Bumped by the control task on every accepted mode switch (the `clock_gen` pattern): the
+    // pump resets the controller's mode-scoped learned state (host cap, encode baseline).
+    let mode_gen = Arc::new(AtomicU32::new(0));
 
     // Control task (see [`control_task`]): the handshake stream stays open for mid-stream
     // renegotiation, speed tests, clock re-sync, and clipboard metadata.
@@ -128,6 +134,7 @@ pub(super) async fn run_pump(args: WorkerArgs) {
             clock_gen: clock_gen.clone(),
             clip_event_tx: clip_event_tx.clone(),
             cursor_shape_tx,
+            mode_gen: mode_gen.clone(),
         }
         .run(),
     );
@@ -141,6 +148,7 @@ pub(super) async fn run_pump(args: WorkerArgs) {
         hidout_tx,
         hdr_meta_tx,
         host_timing_tx,
+        encode_lat.clone(),
         cursor_state_tx,
     ));
 
@@ -176,6 +184,8 @@ pub(super) async fn run_pump(args: WorkerArgs) {
         clock_offset,
         clock_gen,
         decode_lat,
+        encode_lat,
+        mode_gen,
         frames_dropped,
         fec_recovered,
         bitrate_ack,